--- title: Hardware Wallets keep getting PWNed | daily.dev description: A video breaks down two hardware wallet security failures: a Trezor third-party shipping provider data breach exposing names, emails, phone numbers, and... canonical: https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hardware Wallets keep getting PWNed | daily.dev og:description: A video breaks down two hardware wallet security failures: a Trezor third-party shipping provider data breach exposing names, emails, phone numbers, and... og:url: https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo og:image: https://api.daily.dev/og/posts/SqR4GYCUO.png og:image:alt: Hardware Wallets keep getting PWNed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hardware Wallets keep getting PWNed **[Eric Parker](https://daily.dev/sources/ericparker)** · 20 min read · 0 upvotes · 0 comments ## Summary A video breaks down two hardware wallet security failures: a Trezor third-party shipping provider data breach exposing names, emails, phone numbers, and addresses of roughly 14,000 customers, following a similarly notorious Ledger customer database leak that has fueled years of scam calls. Separately, it details how the Coldcard Mk4 wallet's random number generator was quietly swapped from a secure hardware source to a predictable software fallback in a 2021 firmware commit, driven by a licensing dispute that led developers to avoid Trezor's GPL code and rewrite key generation themselves, introducing a broken macro guard that went unnoticed for years despite an external researcher flagging concerns about the RNG a year earlier. The host closes by suggesting cryptocurrency ETFs like IBIT as a lower-hassle alternative to self-custody hardware wallets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the Coldcard hardware wallet random number generator vulnerability found in 2021? A single 2021 firmware commit swapped Coldcard's key generation from the secure Trezor GPL library to an insecure in-house NGU library, motivated by a desire to avoid sharing GPL-licensed code with competitors. The replacement mixed two weak software generators, one with hard-coded constants providing no randomness and another predictable within roughly a 16-bit space using hardware ID and timestamp, plus a broken macro guard that failed to catch the flaw. _Anyone auditing wallet or crypto key-generation code can track findings like this RNG flaw through daily.dev._ ### What information was exposed in the Trezor customer data breach disclosed around August 2025? Names, email addresses, phone numbers, and shipping addresses of 11,742 customers were compromised, along with names, cities, and email addresses of another 1,947 customers, totaling about 14,000 affected people. The breach originated from a third-party shipping provider rather than Trezor's own systems, and affected new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who purchased within 90 days before August 8th. _Developers tracking third-party vendor breach fallout can follow incident writeups like this on daily.dev._ ### Why is trusting a hardware wallet's random number generator risky compared to alternatives like dice for seed generation? Trusting a vendor's RNG concentrates risk in a single point of failure, since a compromised or deliberately weakened generator can produce predictable private keys despite claims of hardware-based entropy, as happened when Coldcard's generator was silently swapped to an insecure software fallback for years. Alternatives like physical dice rolls or Cloudflare's lava lamp method provide verifiable randomness that does not depend on trusting a single company's implementation. _Engineers weighing entropy sources for key generation can compare approaches discussed on daily.dev._ ## Similar posts on daily.dev - [Crypto hardware wallet owners face fresh security risks after recent spate of personal data thefts](https://daily.dev/posts/crypto-hardware-wallet-owners-face-fresh-security-risks-after-recent-spate-of-personal-data-thefts-cfoxbggml) · TechCrunch · 0 upvotes · 0 comments - [They Didn’t Steal Your Keys. They Regenerated Them.](https://daily.dev/posts/they-didn-t-steal-your-keys-they-regenerated-them--zeogglmg2) · Coins Bench · 3 upvotes · 1 comments - [Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider](https://daily.dev/posts/scammers-target-hundreds-of-thousands-of-crypto-owners-after-trezor-confirms-data-breach-of-email-pr-je4d4ipgf) · TechCrunch · 1 upvotes · 0 comments --- Tags: [#crypto](https://daily.dev/tags/crypto), [#cryptography](https://daily.dev/tags/cryptography), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hardware Wallets keep getting PWNed","url":"https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo"},"datePublished":"2026-08-14T15:01:34.777Z","dateModified":"2026-08-14T15:02:01.539Z","description":"A video breaks down two hardware wallet security failures: a Trezor third-party shipping provider data breach exposing names, emails, phone numbers, and...","image":"https://i.ytimg.com/vi/-FIdwclRTP4/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/-FIdwclRTP4/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crypto,cryptography,data-breach","timeRequired":"PT20M","video":{"@type":"VideoObject","name":"Hardware Wallets keep getting PWNed","description":"A video breaks down two hardware wallet security failures: a Trezor third-party shipping provider data breach exposing names, emails, phone numbers, and...","thumbnailUrl":"https://i.ytimg.com/vi/-FIdwclRTP4/sddefault.jpg","uploadDate":"2026-08-14T15:01:34.777Z","duration":"PT20M","url":"https://api.daily.dev/r/SqR4GYCUO","embedUrl":"https://www.youtube.com/embed/-FIdwclRTP4"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"Hardware Wallets keep getting PWNed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hardware-wallets-keep-getting-pwned-sqr4gycuo#faq","mainEntity":[{"@type":"Question","name":"What caused the Coldcard hardware wallet random number generator vulnerability found in 2021?","acceptedAnswer":{"@type":"Answer","text":"A single 2021 firmware commit swapped Coldcard's key generation from the secure Trezor GPL library to an insecure in-house NGU library, motivated by a desire to avoid sharing GPL-licensed code with competitors. The replacement mixed two weak software generators, one with hard-coded constants providing no randomness and another predictable within roughly a 16-bit space using hardware ID and timestamp, plus a broken macro guard that failed to catch the flaw. Anyone auditing wallet or crypto key-generation code can track findings like this RNG flaw through daily.dev."}},{"@type":"Question","name":"What information was exposed in the Trezor customer data breach disclosed around August 2025?","acceptedAnswer":{"@type":"Answer","text":"Names, email addresses, phone numbers, and shipping addresses of 11,742 customers were compromised, along with names, cities, and email addresses of another 1,947 customers, totaling about 14,000 affected people. The breach originated from a third-party shipping provider rather than Trezor's own systems, and affected new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who purchased within 90 days before August 8th. Developers tracking third-party vendor breach fallout can follow incident writeups like this on daily.dev."}},{"@type":"Question","name":"Why is trusting a hardware wallet's random number generator risky compared to alternatives like dice for seed generation?","acceptedAnswer":{"@type":"Answer","text":"Trusting a vendor's RNG concentrates risk in a single point of failure, since a compromised or deliberately weakened generator can produce predictable private keys despite claims of hardware-based entropy, as happened when Coldcard's generator was silently swapped to an insecure software fallback for years. Alternatives like physical dice rolls or Cloudflare's lava lamp method provide verifiable randomness that does not depend on trusting a single company's implementation. Engineers weighing entropy sources for key generation can compare approaches discussed on daily.dev."}}]} ```